    status endpoint for signing and revoking certificates."
   (schema/enum :signed :revoked))
 
+(def CertificateState
+  "The list of states a certificate may be in."
+  (schema/enum "requested" "signed" "revoked"))
+
 (def CertStatus
   "Various information about the state of a certificate or
    certificate request that is provided by the certificate
    status endpoint."
   {:name          schema/Str
-   :state         (schema/enum "requested" "signed" "revoked")
+   :state         CertificateState
    :dns_alt_names [schema/Str]
    :fingerprint   schema/Str
    :fingerprints  {schema/Keyword schema/Str}})
+
+(def Certificate
+  (schema/pred utils/certificate?))
+
+(def CertificateRequest
+  (schema/pred utils/certificate-request?))
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;;; Definitions

        (utils/crl->pem! new-crl cacrl)
        (log/debugf "Revoked %s certificate with serial %d" subject serial)))))

; TODO docs
(schema/defn ^:always-validate
  set-certificate-status!
  [settings :- CaSettings
   subject :- schema/Str
   desired-state :- DesiredCertState]

        (whitelist-matches? autosign subject))
      false)))

(schema/defn create-agent-extensions :- (schema/pred utils/extension-list?)
  "Given a certificate signing request, generate a list of extensions that
  should be signed onto the certificate. This includes a base set of standard
  extensions in addition to any valid extensions found on the signing request."
  [csr :- CertificateRequest
   capub :- (schema/pred utils/public-key?)]
  (let [subj-pub-key (utils/get-public-key csr)
        csr-ext-list (utils/get-extensions csr)
        base-ext-list [(utils/netscape-comment
